Export limit exceeded: 11929 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11929 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-34892 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-10-31 | 6.5 Medium |
| Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through 1.0.271. | ||||
| CVE-2026-118539 | 1 Drupal | 1 Commerce Core | 2026-10-31 | 6.5 Medium |
| Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-116896 | 1 Redaxo | 2 Core, Redaxo | 2026-10-31 | 7.5 High |
| REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking. | ||||
| CVE-2026-116876 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-10-31 | 7.1 High |
| Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move restrictions without checking the author's rights, locking other editors and administrators out. | ||||
| CVE-2026-116623 | 1 Code-projects | 1 Simple Content Management System | 2026-10-31 | 7.3 High |
| A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-62122 | 2 Arraytics, Wordpress-extensions | 2 Booktics, Booktics | 2026-10-31 | 5.3 Medium |
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. | ||||
| CVE-2026-68482 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-30 | 5.3 Medium |
| Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-116401 | 2026-10-30 | 7.5 High | ||
| Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | ||||
| CVE-2026-118804 | 2 Bricks, Wordpress-extensions | 2 Bricks Builder, Bricks Builder | 2026-10-30 | 7.5 High |
| Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes. | ||||
| CVE-2026-115302 | 1 Wordpress-extensions | 1 Contact Form By Supsystic | 2026-10-30 | 5.3 Medium |
| The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries. | ||||
| CVE-2026-110030 | 1 Wordpress-extensions | 1 Hide Price Until Login | 2026-10-30 | 5.3 Medium |
| The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled. | ||||
| CVE-2026-114193 | 2 Eyal Fitoussi, Wordpress-extensions | 2 Geo My Wordpress, Geo My Wordpress | 2026-10-30 | 7.5 High |
| Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5. | ||||
| CVE-2026-62047 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2. | ||||
| CVE-2026-107309 | 1 Drupal | 1 Easy Breadcrumb | 2026-10-30 | 3.7 Low |
| Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11. | ||||
| CVE-2026-107267 | 1 Drupal | 1 Dkan | 2026-10-30 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5. | ||||
| CVE-2026-96389 | 1 Drupal | 1 Xray Audit | 2026-10-30 | 6.5 Medium |
| Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1. | ||||
| CVE-2026-119653 | 1 Admpub | 1 Nging | 2026-10-30 | 4.3 Medium |
| Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist. | ||||
| CVE-2026-119763 | 1 Thechangelog | 1 Changelog.com | 2026-10-30 | 5.3 Medium |
| changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter slugs and integer news IDs against preview endpoints to read draft posts, unsent newsletters and declined news items. | ||||
| CVE-2026-13747 | 2 Tigroumeow, Wordpress-extensions | 2 Meow Gallery, Meow Gallery | 2026-10-30 | 6.5 Medium |
| The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users. | ||||
| CVE-2026-96391 | 1 Drupal | 1 Webform | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.2.1. | ||||